Data Processing Addendum

This Data Processing Addendum (the "Addendum") is part of the Terms of Service (the "Terms") between you, the customer ("you"), and BA Solutions, LLC, Tacoma, Washington, United States ("we", "us"). It applies automatically, with no signature needed, whenever you are subject to the EU General Data Protection Regulation ("GDPR"), the UK GDPR or the Swiss Federal Act on Data Protection ("FADP") for the personal data we process on your behalf. You accept it when you accept the Terms. If you would like a copy signed by both parties for your records, write to support@setlinks.io; the signed copy has the same content as this page.

What it covers. "Customer Personal Data" means the personal data about Link visitors — people who open one of your SetLinks short links or scan one of your QR codes — that we process on your behalf to deliver your links and report their clicks to you, as described in Annex I. "Data Protection Law" means the GDPR, the UK GDPR with the UK Data Protection Act 2018, and the FADP, each where it applies. Words defined in the GDPR, such as "controller", "processor", "processing" and "personal data breach", have the same meaning here.

What it does not cover. Your own account data, and that of your team members, which we process as controller under our Privacy Policy; and the raw access log our CDN writes for each request, which we also keep as controller, for 30 days, to deliver short links and keep them secure (Privacy Policy § 2). What we derive from that log for your statistics is Customer Personal Data.

Duration. This Addendum applies for as long as we process Customer Personal Data, and ends when the last of it has been deleted under § 9.

Order of precedence. If this Addendum and the rest of the Terms conflict on the processing of Customer Personal Data, this Addendum prevails. If the Standard Contractual Clauses incorporated by § 11 conflict with this Addendum, the Clauses prevail.

Liability. Our liability under this Addendum is subject to the limitation of liability in the Terms (§ 14), except to the extent Data Protection Law or the Standard Contractual Clauses do not allow it to be limited. Nothing in this Addendum limits the rights of Link visitors under Data Protection Law or the Clauses.

Changes. We may change this Addendum as the Terms allow (§ 17). We will not make a change that reduces the protection this Addendum gives Customer Personal Data, unless Data Protection Law or a supervisory authority requires it.

For Customer Personal Data, you are the controller and we are your processor. You decide to create a link and to measure it; we count its clicks for you, under your instructions. If you use SetLinks on behalf of your own client, so that you are yourself a processor, we are your subprocessor; you confirm that your client has authorised your instructions and our engagement as your subprocessor, including the subprocessors in § 6, and you remain our only point of contact for that client.

You are responsible for:

• having a lawful basis for measuring your links, and for the instructions you give us;
• giving Link visitors the information Data Protection Law requires about that measurement;
• not placing personal data — and in particular special categories of personal data — in your slugs, link names or the ?s= tag of your links, since a ?s= tag is recorded exactly as it is written;
• keeping your own account secure, including who you invite to your team and who holds your API keys.

The subject matter, nature, purpose and duration of the processing, and the types of personal data and categories of data subjects, are set out in Annex I.

We process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country, unless the law of the EU, of an EU Member State, of the United Kingdom or of Switzerland that applies to us requires otherwise. In that case, we will tell you about that legal requirement before processing, unless that law prohibits it on important grounds of public interest.

Your instructions are the Terms, this Addendum, and the way you use and configure the Service: creating, editing, pausing and deleting links, turning store attribution on or off, and reading your statistics in the dashboard or through the API. You may give further instructions in writing to support@setlinks.io, provided they are consistent with the Terms. If we cannot follow an instruction, we will tell you, and you may stop using the affected part of the Service.

We will inform you immediately if, in our opinion, an instruction infringes Data Protection Law.

We do not sell Customer Personal Data, use it for advertising, or use it for any purpose of our own. We do not try to identify individual Link visitors.

We ensure that everyone we authorise to process Customer Personal Data is bound by an appropriate obligation of confidentiality, by contract or by law, which continues after their work for us ends. Access to customer data is limited to the people who need it to run the Service. Our internal staff tool requires an individual grant at one of three levels, and it shows click totals per link, not individual click records.

We implement the technical and organisational measures in Annex II to protect Customer Personal Data, as Article 32 of the GDPR requires. They are chosen for the nature of the data: a click record holds a country, not an IP address, and no name or other direct identifier.

We may change these measures as the Service develops, provided the overall level of protection is not reduced. We help you meet your own obligations under Article 32 by keeping Annex II accurate and answering reasonable questions about it (§ 10).

You give us a general written authorisation to engage subprocessors. Today, one subprocessor processes Customer Personal Data: Amazon Web Services, which hosts it in the EU, in Stockholm, Sweden, and delivers your links through CDN edge locations worldwide. The other providers on our Subprocessors page process our customers' own account data, for which we are the controller, and receive no Customer Personal Data. The Amazon Web Services entry on that page, with what it receives and where, forms Annex III of this Addendum.

We announce any new or replacement subprocessor on the Subprocessors page and in the legal change log, and tell the owner of each team by email, at least 30 days before it starts processing personal data. If we must replace a subprocessor sooner, because it stops providing its service or to protect the security of the Service or of personal data, we will announce the change as soon as we can, and you may object within 30 days of that announcement, with the consequences described below. Where the Clauses apply, this does not shorten the notice Clause 9(a) requires.

If you object to a new subprocessor on reasonable data-protection grounds, write to support@setlinks.io within that 30-day period. We will discuss your objection with you in good faith. If we cannot address it, you may end the affected subscription, or, on the Free plan, stop using the Service, and we will refund any fees you paid in advance for the period you will no longer use.

We bind each subprocessor that processes Customer Personal Data by a written contract that imposes data-protection obligations no less protective than those in this Addendum, including sufficient guarantees of appropriate technical and organisational measures. We remain fully responsible to you for each subprocessor's performance of those obligations. On request, we will give you a copy of the data-protection terms of a subprocessor agreement, from which we may remove commercial or confidential information.

Requests from Link visitors

If a Link visitor asks us to exercise a right under Data Protection Law in relation to Customer Personal Data, we will forward the request to you without undue delay, and we will not answer it ourselves, beyond telling the person that we have passed it on, unless you ask us to.

The Service has no self-serve tool for finding or deleting an individual Link visitor's click records, so we will do it for you on request. Please be aware of a limit that follows from how little we keep: a click record holds no IP address or other identifier. For 30 days, it can be matched to the CDN log line it came from, if the person gives enough detail, such as their IP address and the time of the click; after that, neither we nor you can tell which records are theirs.

Other assistance

Taking into account the nature of the processing and the information available to us, we will help you comply with your obligations under Articles 32 to 36 of the GDPR — security, personal data breaches, data protection impact assessments and prior consultation with a supervisory authority — by providing the information in this Addendum and answering your reasonable questions. We will cooperate with a supervisory authority on request, and we keep a record of the processing we carry out on your behalf. On request, we will give you the information about our processing and the laws that apply to us that you reasonably need for your assessment under Clause 14 of the Clauses.

We do not charge for this assistance. If a request requires substantial work beyond what this section describes, we may ask you to cover our reasonable costs, where the law allows, and will tell you before we start.

Our correspondence with you or with anyone else — for example, a request a Link visitor emails to support@setlinks.io — is our own data, which we handle as controller under our Privacy Policy.

We will notify you of a personal data breach affecting Customer Personal Data without undue delay, and in any event within 72 hours after becoming aware of it. We send the notice to the email address of your team's owner, and to any other contact you give us for this purpose.

The notice will describe, as far as we then know: the nature of the breach, including where possible the categories and approximate number of Link visitors and of records concerned; the likely consequences; the measures we have taken or propose to take to address it and mitigate its effects; and a contact who can give you more information. Where we cannot provide all of this at once, we will provide it in phases, without further undue delay.

We will take reasonable steps to contain and investigate the breach and to mitigate its effects. You decide whether to notify a supervisory authority or Link visitors; we will not notify them about Customer Personal Data on your behalf unless you ask us to or the law requires it. Notifying you of a breach is not an admission of fault or liability.

During the Service. When you delete a link, its daily click totals are deleted at once. Individual click records are deleted automatically at most 121 days after the click (the records of each calendar month are removed together once the newest of them is 90 days old), whether or not the link or your account still exists. We will delete individual click records sooner if you ask us to.

At the end of the Service. When you delete your team or your account, every link the team owns is deleted, together with its daily click totals; individual click records follow on the schedule above. If the Terms end without you deleting your team, we will delete it within 30 days after they end; until then you may ask us for a copy under "Return" below. Copies in our database backups roll off within 7 days of any deletion.

Return. The Service does not offer a self-serve export. Before you delete a team or your account, you can ask us at support@setlinks.io for a copy of its Customer Personal Data — its click records and daily totals — in a commonly used, machine-readable format. We cannot return data once it has been deleted, so please ask first.

We will not keep Customer Personal Data after these periods unless the law of the EU, of an EU Member State, of the United Kingdom or of Switzerland requires us to store it. On request, we will confirm the deletion to you in writing.

We will make available to you the information necessary to demonstrate our compliance with Article 28 of the GDPR and this Addendum. Our first answer is documentation: this Addendum, its annexes, the Subprocessors page, and written answers to a reasonable security or privacy questionnaire, which you may send once a year, or more often after a personal data breach or where a supervisory authority asks. We do not currently hold a third-party security certification or audit report.

If that information is not enough to demonstrate compliance, or a supervisory authority or Data Protection Law requires it, you may carry out an audit, including an inspection, yourself or through an independent auditor bound by confidentiality. You must give us at least 30 days' written notice and agree the scope with us in advance; the audit takes place during business hours, at most once in any twelve months unless a personal data breach or a supervisory authority requires otherwise, and at your cost. It may not give access to other customers' data, and for the facilities of our subprocessors we may rely on their own audit reports. Where the Standard Contractual Clauses apply, nothing in this section limits the audit rights they give you.

Customer Personal Data is stored in the EU. We are a company in the United States, our staff and contractors may access it from outside the European Economic Area, the United Kingdom and Switzerland, and our CDN answers link requests from edge locations worldwide. Where Customer Personal Data is transferred outside the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision under Data Protection Law, the transfer is made under the safeguards below, which are incorporated into this Addendum by reference.

EU

The Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021 (the "Clauses") apply between you as data exporter and us as data importer: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor. For both modules:

• Clause 7 (docking clause) does not apply;
• in Clause 9(a), Option 2 (general written authorisation) applies, with the 30 days' notice set out in § 6;
• the optional wording in Clause 11(a) does not apply;
• in Clause 17, Option 1 applies, and the Clauses are governed by the law of Ireland; in Clause 18(b), disputes are resolved by the courts of Ireland;
• Annex I of the Clauses is completed by Annex I of this Addendum, Annex II by Annex II, and Annex III by the Amazon Web Services entry on the Subprocessors page.

United Kingdom

For transfers governed by the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force since 21 March 2022) applies, together with the Clauses as set out above. Its Table 1 is completed by Annex I of this Addendum, Table 2 by the modules and options above, and Table 3 by Annexes I and II and the Amazon Web Services entry on the Subprocessors page; for Table 4, the data importer may end the UK Addendum as its Section 19 allows.

Switzerland

For transfers governed by the FADP, the Clauses apply with these amendments: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; references to the GDPR are read as references to the FADP; and "Member State" in Clause 18(c) does not prevent data subjects in Switzerland from bringing proceedings where they habitually reside.

Onward transfers

Our contract with Amazon Web Services incorporates the Clauses (Module Three, processor to processor) for any onward transfer of Customer Personal Data outside the European Economic Area, with the equivalent UK and Swiss safeguards.

Requests from public authorities

If a public authority sends us a legally binding request for Customer Personal Data, we will notify you, unless the law prohibits it, and will act as Clause 15 of the Clauses requires, including challenging a request where there are reasonable grounds to consider it unlawful.

Your acceptance of the Terms is your signature of the Clauses and the UK Addendum, and ours is the offer of the Terms. If the Clauses or the UK Addendum are replaced or no longer provide a valid safeguard, we will work with you in good faith to put an appropriate alternative in place.

A. The parties

B. Description of the processing and transfer

C. Competent supervisory authority

• If you are established in the EU, the supervisory authority responsible for you under Clause 13(a).
• If you are not established in the EU but have appointed a representative under Article 27 of the GDPR, the supervisory authority of the Member State in which your representative is established.
• If you are not established in the EU and are not required to appoint a representative, the Irish Data Protection Commission.
• For transfers under the UK GDPR, the Information Commissioner's Office; under the FADP, the Swiss Federal Data Protection and Information Commissioner.

These are the technical and organisational measures we apply to Customer Personal Data. We list only measures that are in place today.

Collecting less

• No IP address is stored in click records, in full or in part: it is used for one country lookup, in a database held on our own systems, and discarded. The user agent is reduced to a device class and a bot flag.
• Only the host name of a referring page is kept, not the full address.
• The service that answers short links reads only the device and language headers, sets no cookie and writes nothing.
• Individual click records are deleted automatically by a daily job (§ 9); the CDN's raw access logs are deleted after 30 days.

Encryption

• In transit: our CDN accepts TLS 1.2 or higher only and redirects plain HTTP to HTTPS; our servers reach the database over TLS with a pinned certificate authority, and the cache over TLS; our file storage refuses unencrypted connections.
• At rest: the database and file storage are encrypted; the store that answers redirects uses AWS's default encryption.

Network

• The database is not reachable from the internet and sits in a private network; our application servers on AWS have no public IP address.
• The file storage behind our CDN, including the bucket that holds access logs, blocks all public access.

Access control

• Access to customer data is limited to the people who need it to run the Service. Our internal staff tool requires an individual grant at one of three levels, refuses anyone without one, and shows click totals per link, not individual click records.
• Customers sign in through Google Firebase Authentication; a verified email address is required before an account can be used, and sign-in tokens are checked for revocation on every signed-in request. In the dashboard and the API, a link's statistics are available only to the team that owns it.
• API keys and invitation tokens are stored only as SHA-256 hashes.
• Secrets are kept in AWS Secrets Manager.
• Notifications our servers receive from our payment and support-desk providers are checked for a valid signature.
• Password reset, verification, card, upload and API requests are rate-limited.

Logging and monitoring of errors

• Our API's request logs hold no IP address or user agent, and redact credentials; they are deleted after 30 days.
• Errors are reported to Sentry in the EU (Germany), configured not to send the personal data Sentry collects by default.

Resilience

• The database has automated backups kept for 7 days and is protected against deletion; the store that answers redirects has point-in-time recovery.
• If the database is unavailable, links already published keep resolving, because the redirect service does not depend on it.